Authentication Authority Under Attack

Wednesday, June 22, 2011 @ 12:06 PM gHale

Attacks are definitely getting more sophisticated as one more web authentication authority was the victim of an attack as hackers want to grab certificates and then counterfeit them so they can spoof the authenticated pages of high-profile sites.

StartCom, which operates StartSSL suffered a security breach that occurred last Wednesday, the Israel-based company said in an advisory. The certificate authority, trusted by the Microsoft Internet Explorer, Google Chrome, and Mozilla Firefox browsers to vouch for the authenticity of sensitive websites, has suspended issuance of digital certificates and related services until further notice.

Attackers went after the same websites targeted during a similar breach in March against certificate authority Comodo, said Eddy Nigg, StartCom’s CTO and COO. The hackers in the earlier attack forged certificates for seven addresses, including Google mail, www.google.com, login.yahoo.com, login.skype.com, addons.mozilla.com, and Microsoft’s login.live.com.

The earlier breach led the world’s largest browser companies to blacklist the counterfeit credentials before the hackers could use them to create spoof websites that contained a valid cryptographic stamp validating the sites’ authenticity. It took more than a week for the browsers to block the fraudulent credentials, and even then, widely used email programs still did not issue an update.

The hackers behind the attack on StartCom failed to obtain any certificates that would allow them to spoof websites in a similar fashion, and they were also unsuccessful in generating an intermediate certificate that would allow them to act as their own certificate authority, Nigg said. The private encryption key at the heart of the company’s operations is not on a computer attached to the Internet, he said.

Last week’s attack is at least the fifth time an entity that issues SSL, or secure sockets layer, certificates suffered an attack.

The susceptibility of CAs to hackers represents one of the vulnerabilities of the SSL system, which serves as the Internet’s foundation of trust. Once a CA’s root certificate connects with a browser, it can be responsible for validating tens of thousands or hundreds of thousands of individual websites. That makes it impractical to remove the root certificate even if there is good reason to be wary of it.